CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

U.S. Dept Of Defense: Publicly Editable U.S. Air Force Google Spreadsheet Exposing Student Leave Data

The U.S. Air Force Google Spreadsheet that exposed student leave data was publicly editable, allowing any unauthorized user to access and modify the restricted contents...